Your submission was sent successfully! Close

CVE-2017-14333

Published: 12 September 2017

The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next, during "readelf -a" execution.

Priority

Low

CVSS 3 base score: 7.8

Status

Package Release Status
binutils
Launchpad, Ubuntu, Debian
Upstream
Released (2.29.1)
Ubuntu 21.10 (Impish Indri) Not vulnerable
(2.29.1-1ubuntu1)
Ubuntu 21.04 (Hirsute Hippo) Not vulnerable
(2.29.1-1ubuntu1)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(2.29.1-1ubuntu1)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(2.29.1-1ubuntu1)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (2.26.1-1ubuntu1~16.04.8+esm1)
Ubuntu 14.04 ESM (Trusty Tahr) Needed

Patches:
Upstream: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=452bf675ea772002aa86fb1d28f3474da70ee1de
Upstream: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=64aa1246572306b72dc479b46d13ff749b0c3236

Notes

AuthorNote
leosilva
code in precise and trusty are quite different, needs backport
sbeattie
for 2.29 branch, 64aa1246572306b72dc479b46d13ff749b0c3236 is
an omnibus patch set
mdeslaur
included in second CVE-2017-12450 commit

References